AppSensor Guide Application-Specific Real-Time Attack Detection & Response Version 48 (Draft)
Chapter 25 : Using an External Log Management System
Download 11.95 Mb.
|
- Navigate this page:
- Description
- AppSensor scope
- Source code
- Considerations
- Related implementations
Chapter 25 : Using an External Log Management SystemIntroductionAn external log management system can be used to aggregate event data and generate some types of responses such as alerts or network changes. An organization with a large number of applications that already has some form of Security Information and Event Management (SIEM) or other Continuous Security Monitoring (CSM) may benefit from this type of approach. This demonstration implementation does not form part of the core development efforts within the OWASP AppSensor Project. DescriptionDetection points are added into each application’s source code like a standard AppSensor implementation. But information from the detection points are sent to an external log aggregation and event management system. The external system is responsible for determining the attack and initiating responses. Events collected by detection points are sent to a centralized system using Common Event Format123 (CEF) over syslog protocol. Schematic Arrangement of Example External Log Management System 
AppSensor scopeAny detection points capable of being added to the application(s) and elsewhere could provide event data to the external system. Although potentially any response is possible, assume the signaling is one-way from the application(s) to the external system,. Then the most likely responses supportable via the network are: List of Response Categories Possibly Available to an External Log/Event Management System
Of these, administrator notification is the most common (and not necessarily the most effective use of AppSensor capabilities). Source codeNo source code is available. ImplementationThis method still requires the addition of detection points to application code, which is application dependent. All other conceptual elements are undertaken external to the application(s). An example message structure is shown on the next page. This utilizes predefined and custom key-value pairs in the extension part of CEF: User agents string Application detection point identifier AppSensor detection point category HTTP status code Request ID (a unique identifier for each application request) Local log identifier Degree of confidence (in the example 100%). Example Use of Common Event Format for Event Signaling
ConsiderationsThis method may not be completely “real time” nor provide feedback information for the application(s) to adapt to the attack. See also Chapter 18 : AppSensor and Application Event Logging for a discussion about generic application event logging. AppSensor data might simply be used to enhance attack and threat intelligence for fraud detection or advanced persistent threat identification. Related implementationsSimilar logging ideas could be implemented using the open source OSSEC or many commercial log management systems. Existing security monitoring systems should always be considered as a recipient of AppSensor data, regardless of where the event analysis and event management is being undertaken. Signaling AppSensor event and attack data to an event monitoring system adds valuable information to an organization’s threat and attack knowledge. Dinis Cruz has suggested that Google Analytics could be utilized to perform this type of externalized data collection and analysis, but with limited ability for response. In some systems, GA may be one of the few destinations that internal applications have been allowed to communicate to. Directory: images -> archive images -> World-renowned vocal ensemble sweet honey in the rock images -> Peoples Voice Café History archive -> J. Welles Henderson Archives and Library archive -> The Heartbeat Beacon Abstract archive -> E9-1-1 Heartbeat Abstract archive -> HL7 Mobile Health Application Functional Framework; Consumer mhaFF, Release 1 (pi id: 1182) archive -> Opensfs benchmarking Working Group I/o survey Report archive -> Opensfs benchmarking Working Group I/o survey Report archive -> Need a computer and can't afford one? Download 11.95 Mb. Share with your friends:
| |||||||||||||||||||||||||